Custom sources: declarative validate endpoint for live key checks at auth login

[dyoung522]

From the source-registry design (§9): custom sources' keys are stored unvalidated ("validated on first use") because AuthConfig has no validate-endpoint concept. Add one so a definition can declare a probe; the source then implements the existing source.KeyValidator seam and lmm auth login validates custom keys live, same as built-ins.

[kimberly-WY]

Good catch. This is related to the RFC change in how trailing slashes are normalized. PR incoming.